CVE-2024-41709: Backdrop CMS Field Label Sanitization Vulnerability
Summary
CVE-2024-41709: Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places. Affects backdrop/backdrop across 2 version ranges.
< 1.27.3
>= 1.28.0, < 1.28.2
Fixed in 1.27.3 or 1.28.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Backdrop CMS is an open-source content management system that allows users to create and manage websites. It provides various features and functionalities, including the ability to create custom fields for content types. These fields can have labels associated with them, which are used to identify and display the fields in certain places within the CMS.
Vulnerability Detail
Backdrop CMS versions before 1.27.3 and 1.28.x before 1.28.2 suffer from a field label sanitization vulnerability. This vulnerability arises due to insufficient sanitization of field labels before they are displayed in certain areas of the CMS. An attacker with the 'administer fields' permission can exploit this vulnerability to inject malicious code or execute cross-site scripting (XSS) attacks. The impact of this vulnerability can range from unauthorized access to sensitive information to the complete compromise of the affected CMS instance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.27.31.27.3composer require backdrop/backdrop:1.27.3 -
>= 1.28.0, < 1.28.21.28.2composer require backdrop/backdrop:1.28.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually sanitize field labels by ensuring that they do not contain any potentially malicious code or characters. This can be done by reviewing and modifying the field labels in the CMS administration interface.
Conclusion
Backdrop CMS versions before 1.27.3 and 1.28.x before 1.28.2 are vulnerable to a field label sanitization issue that can be exploited by attackers with the 'administer fields' permission. Updating to the patched versions or manually sanitizing field labels can mitigate the risk of exploitation.
See every vulnerability recorded for backdrop/backdrop →
FAQ
Backdrop CMS is an open-source content management system that allows users to create and manage websites. It provides various features and functionalities for website development.
This vulnerability can allow an attacker to inject malicious code or execute cross-site scripting (XSS) attacks, potentially leading to unauthorized access to sensitive information or the complete compromise of the affected Backdrop CMS instance.
An attacker with the 'administer fields' permission in Backdrop CMS can exploit this vulnerability.
To fix this vulnerability, it is recommended to update Backdrop CMS to version 1.27.3 if using a version prior to 1.27.3, or to version 1.28.2 if using a version between 1.28.0 and 1.28.1.
As a temporary workaround, users can manually sanitize field labels by ensuring that they do not contain any potentially malicious code or characters.
References
Related vulnerabilities
Recent vulnerabilities recorded for backdrop/backdrop.
